# Vulnerabilities published in 2026


- [CVE-2026-83464](https://insights.sbomify.com/CVE-2026-83464/): Privilege escalation in Oracle Mobile Application Server (high 8.1)
- [CVE-2026-83463](https://insights.sbomify.com/CVE-2026-83463/): Privilege escalation in Oracle Mobile Application Server (high 7.5)
- [CVE-2026-83462](https://insights.sbomify.com/CVE-2026-83462/): Auth bypass in Oracle Mobile Application Server (critical 9.8)
- [CVE-2026-83461](https://insights.sbomify.com/CVE-2026-83461/): Missing authorization in Oracle Mobile Application Server (high 8.2)
- [CVE-2026-83460](https://insights.sbomify.com/CVE-2026-83460/): Missing authorization in Helidon (medium 6.5)
- [CVE-2026-8346](https://insights.sbomify.com/CVE-2026-8346/): D-Link DIR-816 portForward command injection (medium 5.3)
- [CVE-2026-83459](https://insights.sbomify.com/CVE-2026-83459/): Denial of service in Helidon (medium 5.3)
- [CVE-2026-83458](https://insights.sbomify.com/CVE-2026-83458/): Denial of service in Helidon (medium 5.3)
- [CVE-2026-83457](https://insights.sbomify.com/CVE-2026-83457/): Denial of service in Oracle Demand Signal Repository (high 8.1)
- [CVE-2026-83456](https://insights.sbomify.com/CVE-2026-83456/): Privilege escalation in Oracle Demand Signal Repository (high 8.8)
- [CVE-2026-83455](https://insights.sbomify.com/CVE-2026-83455/): Missing authorization in Oracle Demand Signal Repository (high 8.1)
- [CVE-2026-83454](https://insights.sbomify.com/CVE-2026-83454/): Privilege escalation in Oracle Document Management and Collaboration (high 8.8)
- [CVE-2026-83453](https://insights.sbomify.com/CVE-2026-83453/): Privilege escalation in Oracle Document Management and Collaboration (high 7.2)
- [CVE-2026-83452](https://insights.sbomify.com/CVE-2026-83452/): Auth bypass in Oracle Document Management and Collaboration (critical 9.8)
- [CVE-2026-83451](https://insights.sbomify.com/CVE-2026-83451/): Privilege escalation in Oracle Product Workbench (high 8.5)
- [CVE-2026-83450](https://insights.sbomify.com/CVE-2026-83450/): Privilege escalation in Oracle Bills of Material (high 8.0)
- [CVE-2026-8345](https://insights.sbomify.com/CVE-2026-8345/): D-Link DIR-816 singlePortForward sub_445E7C command injection (medium 5.3)
- [CVE-2026-83449](https://insights.sbomify.com/CVE-2026-83449/): Missing authorization in Oracle Bills of Material (high 8.5)
- [CVE-2026-83448](https://insights.sbomify.com/CVE-2026-83448/): Missing authorization in Oracle Bills of Material (high 8.1)
- [CVE-2026-83447](https://insights.sbomify.com/CVE-2026-83447/): Missing authorization in Oracle Bills of Material (high 8.1)
- [CVE-2026-83446](https://insights.sbomify.com/CVE-2026-83446/): Missing authorization in Oracle Financials Common Modules (high 8.1)
- [CVE-2026-83445](https://insights.sbomify.com/CVE-2026-83445/): Privilege escalation in Oracle Complex Maintenance, Repair and Overhaul (high 8.8)
- [CVE-2026-83444](https://insights.sbomify.com/CVE-2026-83444/): Privilege escalation in Oracle Product Hub (high 8.8)
- [CVE-2026-83443](https://insights.sbomify.com/CVE-2026-83443/): Information disclosure in Oracle Assets (medium 6.5)
- [CVE-2026-83442](https://insights.sbomify.com/CVE-2026-83442/): Privilege escalation in Oracle Product Hub (high 7.2)
- [CVE-2026-83441](https://insights.sbomify.com/CVE-2026-83441/): Missing authorization in Oracle Product Hub (medium 6.8)
- [CVE-2026-83440](https://insights.sbomify.com/CVE-2026-83440/): Privilege escalation in Oracle Product Hub (high 7.2)
- [CVE-2026-8344](https://insights.sbomify.com/CVE-2026-8344/): D-Link DIR-816 formDMZ.cgi sub_445E7C command injection (medium 5.3)
- [CVE-2026-83439](https://insights.sbomify.com/CVE-2026-83439/): Missing authorization in Helidon (high 8.1)
- [CVE-2026-83438](https://insights.sbomify.com/CVE-2026-83438/): Missing authorization in Oracle Engineering (high 8.2)
- [CVE-2026-83437](https://insights.sbomify.com/CVE-2026-83437/): Information disclosure in Oracle Engineering (high 7.7)
- [CVE-2026-83436](https://insights.sbomify.com/CVE-2026-83436/): Denial of service in Oracle Depot Repair (high 7.1)
- [CVE-2026-83435](https://insights.sbomify.com/CVE-2026-83435/): Missing authorization in Oracle Bills of Material (high 8.2)
- [CVE-2026-83434](https://insights.sbomify.com/CVE-2026-83434/): Missing authorization in Oracle Product Workbench (high 8.1)
- [CVE-2026-83433](https://insights.sbomify.com/CVE-2026-83433/): Missing authorization in Oracle Depot Repair (medium 6.5)
- [CVE-2026-83432](https://insights.sbomify.com/CVE-2026-83432/): Missing authorization in Oracle Depot Repair (high 8.1)
- [CVE-2026-83431](https://insights.sbomify.com/CVE-2026-83431/): Missing authorization in Oracle Product Workbench (medium 5.4)
- [CVE-2026-83430](https://insights.sbomify.com/CVE-2026-83430/): Missing authorization in Oracle Product Workbench (high 8.1)
- [CVE-2026-83429](https://insights.sbomify.com/CVE-2026-83429/): Missing authorization in Oracle Demand Signal Repository (high 8.1)
- [CVE-2026-83428](https://insights.sbomify.com/CVE-2026-83428/): Missing authorization in Oracle Demand Signal Repository (high 8.1)
- [CVE-2026-83427](https://insights.sbomify.com/CVE-2026-83427/): Missing authorization in PeopleSoft Enterprise PeopleTools (medium 6.6)
- [CVE-2026-83426](https://insights.sbomify.com/CVE-2026-83426/): Auth bypass in Oracle Access Manager (high 8.7)
- [CVE-2026-83425](https://insights.sbomify.com/CVE-2026-83425/): Information disclosure in Oracle Complex Maintenance, Repair and Overhaul (high 8.5)
- [CVE-2026-83424](https://insights.sbomify.com/CVE-2026-83424/): Information disclosure in Oracle JDeveloper (high 7.5)
- [CVE-2026-83423](https://insights.sbomify.com/CVE-2026-83423/): Privilege escalation in Oracle JDeveloper (high 8.8)
- [CVE-2026-83422](https://insights.sbomify.com/CVE-2026-83422/): Missing authorization in Oracle Identity Manager (high 8.1)
- [CVE-2026-83420](https://insights.sbomify.com/CVE-2026-83420/): Privilege escalation in PeopleSoft Enterprise FIN Engineering Brazil (high 7.8)
- [CVE-2026-83419](https://insights.sbomify.com/CVE-2026-83419/): Information disclosure in Oracle Communications Cloud Native Core Security Edge Protection Proxy (medium 5.4)
- [CVE-2026-83418](https://insights.sbomify.com/CVE-2026-83418/): Missing authorization in Oracle Communications Cloud Native Core Security Edge Protection Proxy (high 8.2)
- [CVE-2026-83417](https://insights.sbomify.com/CVE-2026-83417/): Information disclosure in Oracle Communications Cloud Native Core Security Edge Protection Proxy (high 7.1)
- [CVE-2026-83416](https://insights.sbomify.com/CVE-2026-83416/): Denial of service in Oracle Coherence (medium 4.3)
- [CVE-2026-83415](https://insights.sbomify.com/CVE-2026-83415/): Privilege escalation in Oracle Coherence (high 7.5)
- [CVE-2026-83414](https://insights.sbomify.com/CVE-2026-83414/): Information disclosure in Oracle Coherence (low 2.5)
- [CVE-2026-83413](https://insights.sbomify.com/CVE-2026-83413/): Missing authorization in Oracle Coherence (low 1.9)
- [CVE-2026-83412](https://insights.sbomify.com/CVE-2026-83412/): Missing authorization in Oracle Coherence (high 8.1)
- [CVE-2026-83411](https://insights.sbomify.com/CVE-2026-83411/): Privilege escalation in Oracle Coherence (high 8.8)
- [CVE-2026-83410](https://insights.sbomify.com/CVE-2026-83410/): Privilege escalation in Oracle Coherence (high 8.8)
- [CVE-2026-83409](https://insights.sbomify.com/CVE-2026-83409/): Auth bypass in Oracle Access Manager (high 8.1)
- [CVE-2026-83408](https://insights.sbomify.com/CVE-2026-83408/): Code injection in Oracle GraalVM for JDK, Oracle GraalVM (high 8.1)
- [CVE-2026-83407](https://insights.sbomify.com/CVE-2026-83407/): Missing authorization in Oracle Access Manager (high 8.6)
- [CVE-2026-83406](https://insights.sbomify.com/CVE-2026-83406/): Missing authorization in Oracle Communications Billing and Revenue Management (medium 6.7)
- [CVE-2026-83404](https://insights.sbomify.com/CVE-2026-83404/): Missing authorization in MySQL Connectors (high 7.5)
- [CVE-2026-83403](https://insights.sbomify.com/CVE-2026-83403/): Missing authorization in Oracle Identity Manager (high 8.8)
- [CVE-2026-83402](https://insights.sbomify.com/CVE-2026-83402/): Missing authorization in Oracle Identity Manager (high 8.8)
- [CVE-2026-83401](https://insights.sbomify.com/CVE-2026-83401/): Missing authorization in Oracle Identity Manager (medium 6.1)
- [CVE-2026-83400](https://insights.sbomify.com/CVE-2026-83400/): Denial of service in Oracle GraalVM Enterprise Edition (medium 5.3)
- [CVE-2026-8340](https://insights.sbomify.com/CVE-2026-8340/): Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion (low 2.3)
- [CVE-2026-83399](https://insights.sbomify.com/CVE-2026-83399/): Auth bypass in Oracle WebLogic Server (critical 9.8)
- [CVE-2026-83398](https://insights.sbomify.com/CVE-2026-83398/): Missing authorization in Oracle Data Integrator (high 8.2)
- [CVE-2026-83397](https://insights.sbomify.com/CVE-2026-83397/): Auth bypass in Oracle Data Integrator (critical 9.8)
- [CVE-2026-83396](https://insights.sbomify.com/CVE-2026-83396/): Auth bypass in Oracle Data Integrator (critical 9.8)
- [CVE-2026-83395](https://insights.sbomify.com/CVE-2026-83395/): Other in Oracle GraalVM Enterprise Edition (medium 6.5)
- [CVE-2026-83394](https://insights.sbomify.com/CVE-2026-83394/): Information disclosure in Oracle Demand Planning (medium 6.8)
- [CVE-2026-83393](https://insights.sbomify.com/CVE-2026-83393/): Missing authorization in Oracle Product Hub (high 8.5)
- [CVE-2026-83392](https://insights.sbomify.com/CVE-2026-83392/): Information disclosure in Oracle Applications Manager (low 3.1)
- [CVE-2026-83391](https://insights.sbomify.com/CVE-2026-83391/): Information disclosure in Oracle HRMS (US) (medium 5.4)
- [CVE-2026-83390](https://insights.sbomify.com/CVE-2026-83390/): Information disclosure in Oracle Applications Manager (medium 4.2)
- [CVE-2026-8339](https://insights.sbomify.com/CVE-2026-8339/): SQL Injection in Coverity Connect SOAP API (high 8.7)
- [CVE-2026-83389](https://insights.sbomify.com/CVE-2026-83389/): Information disclosure in Oracle HRMS (UK) (medium 5.4)
- [CVE-2026-83388](https://insights.sbomify.com/CVE-2026-83388/): Information disclosure in Oracle Applications Manager (low 2.2)
- [CVE-2026-83387](https://insights.sbomify.com/CVE-2026-83387/): Information disclosure in Oracle GraalVM Enterprise Edition (medium 5.9)
- [CVE-2026-83386](https://insights.sbomify.com/CVE-2026-83386/): Information disclosure in Oracle HRMS (US) (medium 6.5)
- [CVE-2026-83385](https://insights.sbomify.com/CVE-2026-83385/): Information disclosure in Oracle HRMS (US) (medium 6.5)
- [CVE-2026-83384](https://insights.sbomify.com/CVE-2026-83384/): Information disclosure in Oracle HRMS (US) (medium 6.5)
- [CVE-2026-83383](https://insights.sbomify.com/CVE-2026-83383/): Information disclosure in Oracle HRMS (US) (medium 6.5)
- [CVE-2026-83382](https://insights.sbomify.com/CVE-2026-83382/): Information disclosure in Oracle Report Manager (medium 4.3)
- [CVE-2026-83381](https://insights.sbomify.com/CVE-2026-83381/): Information disclosure in Oracle Java SE (medium 4.8)
- [CVE-2026-83380](https://insights.sbomify.com/CVE-2026-83380/): Information disclosure in Oracle GraalVM Enterprise Edition (medium 5.3)
- [CVE-2026-8338](https://insights.sbomify.com/CVE-2026-8338/): Authentication and Authorization Bypass in Coverity Connect (critical 9.2)
- [CVE-2026-83379](https://insights.sbomify.com/CVE-2026-83379/): Missing authorization in Oracle Weblogic Server Proxy Plug-in (high 8.7)
- [CVE-2026-83378](https://insights.sbomify.com/CVE-2026-83378/): Other in Oracle Java SE (medium 4.8)
- [CVE-2026-83377](https://insights.sbomify.com/CVE-2026-83377/): Information disclosure in Oracle HRMS (US) (medium 5.4)
- [CVE-2026-83376](https://insights.sbomify.com/CVE-2026-83376/): Information disclosure in Oracle GraalVM Enterprise Edition (low 3.7)
- [CVE-2026-83375](https://insights.sbomify.com/CVE-2026-83375/): Information disclosure in PeopleSoft Enterprise HCM Human Resources (medium 6.0)
- [CVE-2026-83374](https://insights.sbomify.com/CVE-2026-83374/): Other in Oracle GraalVM Enterprise Edition (medium 5.9)
- [CVE-2026-83373](https://insights.sbomify.com/CVE-2026-83373/): Information disclosure in PeopleSoft Enterprise PeopleTools (low 3.0)
- [CVE-2026-83372](https://insights.sbomify.com/CVE-2026-83372/): Information disclosure in PeopleSoft Enterprise PeopleTools (medium 5.4)
- [CVE-2026-83371](https://insights.sbomify.com/CVE-2026-83371/): Information disclosure in Oracle HRMS (UK) (medium 5.4)
- [CVE-2026-83370](https://insights.sbomify.com/CVE-2026-83370/): Information disclosure in Sourcing (high 7.5)
- [CVE-2026-8337](https://insights.sbomify.com/CVE-2026-8337/): Concrete CMS is vulnerable to IDOR in surveys (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/324/